webmproject/libwebp
View on GitHub ↗ ★ 2,423 C
Mirror only. Please do not send pull requests. See https://chromium.googlesource.com/webm/libwebp/+/HEAD/CONTRIBUTING.md.
9 mentions on Hacker News by 9 people: 0 stories, 9 comments · first 2023-09-12 · latest 2023-09-26
20082026
-
…the cost would be relatively small. Small enough that I personally would be happy to pay it. https://github.com/webmproject/libwebp/commit/902bc919033134... This is also a great reminder that fuzzing isn't a solution to memory unsafe…
comment by kevincox · 2023-09-26 · in Google assigns a CVE for libwebp and gives it a 10.0 score -
There's a follow-up fix, according to Debian[0]: https://github.com/webmproject/libwebp/commit/95ea5226c87044... [0]: https://security-tracker.debian.org/tracker/CVE-2023-4863
comment by chrisbolt · 2023-09-22 · in The WebP 0day -
This is the fix: https://github.com/webmproject/libwebp/commit/902bc919033134...
comment by saagarjha · 2023-09-22 · in The WebP 0day -
…Even as a C guru, you are going to make a mistake, at some point. I think this is the fix https://github.com/webmproject/libwebp/commit/dce8397fec159c... "malloc fail"? :facepalm: (oh yes, Slack, Discord, Teams, everything is affected,…
comment by keyle · 2023-09-22 · in The WebP 0day -
…to audit 1674 commits over the past 12 years, it'd be easier to just audit the full project. [0] https://github.com/webmproject/libwebp/commit/21735e06f7c1cb... [1] https://github.com/webmproject/libwebp/commit/c3f41cb47e5f32...
comment by vitus · 2023-09-12 · in Chrome: Heap buffer overflow in WebP -
The original commit in question: https://github.com/webmproject/libwebp/commit/f75dfbf23d1df1... The commit that fixes this bug: https://github.com/webmproject/libwebp/commit/902bc919033134... The original commit optimizes a Huffman…
comment by lifthrasiir · 2023-09-12 · in Chrome: Heap buffer overflow in WebP -
…extremely complex untrusted input (media codecs) in memory unsafe languages? Yep, of course it is: https://github.com/webmproject/libwebp/commit/902bc919033134... I guess libwebp could be excused as it was started when there were no…
comment by kouteiheika · 2023-09-12 · in Chrome: Heap buffer overflow in WebP -
Also interesting: Shortly after there is another commit that is related to oss-fuzz: https://github.com/webmproject/libwebp/commit/95ea5226c87044... This could mean Google optimized their fuzzers for libwebp after finding that bug and now…
comment by hannob · 2023-09-12 · in Chrome: Heap buffer overflow in WebP -
Fix OOB write in BuildHuffmanTable https://github.com/webmproject/libwebp/commit/902bc919033134...
comment by jiripospisil · 2023-09-12 · in Chrome: Heap buffer overflow in WebP